CVE-2024-25621 is a local privilege escalation vulnerability in containerd caused by overly permissive default directory permissions. Local users on the host can access the metadata store, content store, and Kubernetes local volumes, which may contain setuid binaries, enabling privilege escalation. The vulnerability affects several Red Hat products that ship containerd, including OpenShift API for Data Protection and Advanced Cluster Management for Kubernetes. The issue can be mitigated by restricting permissions on containerd directories or running containerd in rootless mode. Red Hat has provided advisories and guidance but the patch status is not explicitly confirmed in the advisory content provided.

Local users with access to the host can exploit overly broad permissions to read and modify containerd metadata and content stores, including Kubernetes local volumes. This can lead to privilege escalation on the host system by leveraging setuid binaries present in the volumes. The vulnerability compromises confidentiality and integrity with high impact, while availability impact is low to none. No active exploitation in the wild has been reported.

Administrators should manually restrict permissions on the following directories to remove group and world access: /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim by setting permissions to 700. Alternatively, running containerd in rootless mode mitigates the issue. Check the Red Hat advisory for updates on official patches or fixes. Patch status is not explicitly confirmed; verify with the vendor advisory for current remediation guidance.